Fundamental SOA Security - S90.18 Exam Practice Test

Question 1

The application of the Service Abstraction principle can hinder your ability to fully determine
how a service composition is secured because you may not be able to find out how all
composed services are secured.

A. True

B. False

Correct Answer: A

Question 2

The requirement to defer security related state data at runtime relates directly to the
application of which service-orientation principle?

A. Service Autonomy

B. Service Abstraction

C. None of the above.

D. Service Loose Coupling

Correct Answer: C

Question 3

Service A requires self-signed digital certificates from all of its service consumers. The
service and its service consumers both belong to the same organization. You are
presented with a new requirement to only allow access to those service consumers with
certificates that have not expired. How can this requirement be addressed with minimal
impacts on the current security architecture?

A. None of the above

B. Using certificates in this scenario is not a valid option.

C. The current security mechanism already addresses this requirement because the
certificates contain a value that represents the validity period.

D. The certificates need to be signed by an external certificate authority so that the
certificate authority's Certificate Revocation List (CRL) can be accessed in order to check
the expiry dates of the certificates.

Correct Answer: C

Question 4

To provide message confidentiality and message integrity, which of the following patterns
need to be applied?

A. Direct Authentication and Brokered Authentication

B. None of the above

C. Data Origin Authentication and Brokered Authentication

D. Data Confidentiality and Direct Authentication

Correct Answer: B

Question 5

Service A relies on a shared identity store. Service B has its own identity store. Service C
also has its own identity store, but must also access the shared identity store used by
Service A.
Which service has the least reduction in autonomy as a result of its relationship with identity store mechanism(s)?

A. Service A

B. Service C

C. The autonomy of all services is affected equally

D. Service B

Correct Answer: D

Question 6

A project team is planning to create a secure service composition that consists of services
from two different domain service inventories. The security mechanisms for each service
inventory are based on different vendor technologies that adhere to the same industry
standards and the same design standards. What is wrong with this service composition
architecture?

A. None of the above

B. Vendor technologies do not adhere to industry standards. Only industry technologies
adhere to industry standards.

C. Because different vendor security technologies were used, services from different
domain service inventories will be using incompatible security credentials.

D. Security mechanisms have a fixed limitation that prevents their usage across service
inventory boundaries.

Correct Answer: A

Question 7

Responses issued by Certificate Revocation Lists (CRLs) and Online Certificate Status
Protocol (OCSP) services need to be ___________ and ___________ so that it can be
determined whether these responses were sent by a trusted certificate authority or a
malicious program pretending to be a certificate authority.

A. encrypted, decrypted

B. signed, verified

C. signed, decrypted

D. encrypted, verified

Correct Answer: B

Question 8

A service that was previously using a shared identity store is now given its own dedicated
identity store instead. What are the likely impacts (positive or negative) that will result from
this change?

A. The potential to apply the Service Abstraction principle is increased.

B. The service's autonomy is increased.

C. The operational responsibility is increased due to the need to keep the dedicated identity
store in synch with a parent identity store.

D. The service will no longer be dependent on a certificate authority.

Correct Answer: B,C

Question 9

Which of the following approaches represents a valid means of utilizing generic security
logic?

A. When required, generic security logic can be abstracted into a separate utility service.
This allows for reuse.

B. When required, generic security logic can be embedded within a service. The close
proximity to the service logic maximizes the chances that the security logic will be
consistently executed without interference from attackers.

C. When required, generic security logic can be abstracted into a service agent. This allows
for reuse and the security logic can be executed in response to runtime events.

D. All of the above.

Correct Answer: D

Question 10

Which of the following are valid reasons for a certificate to be revoked:

A. The subject is no longer permitted to use the certificate

B. The private key has been compromised

C. The certificate was fraudulently obtained

D. The public key has been compromised

Correct Answer: A,B,C

SOA Fundamental SOA Security - S90.18 Exam Practice Test

Latest Update

Useful Links

Contact Us